Monitor a Windows service

[dave_pw]

Hi,

We have a Zabbix 7 install monitoring a number of Windows servers, these where all added with the "Windows by Zabbix agent" template.

Now we find ourselves wanting to monitor a Windows service on these (just a single service on each machine) however I am struggling to work our how to do this. I've done a lot of Googling and all results seem to think this should be happening already and point to a variable to populate with names of services we don't want to monitor, however at the moment that is not the case, no services are being monitored at all.

Now it's possible that it was when we first set this up and I ended up disabling the whole thing as would not have wanted alerts for every single service going.

Ideally I just need to know the expression to put in a trigger to monitor a single service is someone can please help.

Thanks

[t00m1G]

Hey,

To achieve what you want, you should use Zabbix LLD macros, link to the documentation: https://www.zabbix.com/documentation...ros/lld_macros and https://www.zabbix.com/documentation...evel_discovery
With use of LLD macros you can examine which example service you want to be discovered and checked - I'm using that that for the same reason, to eliminate services like "CDPSvc", "BITS", "WpnUserService" and others.
There is also YouTube video about that made by zabbix employees: https://www.youtube.com/watch?v=RGv6CWYrXAU and second one: https://www.youtube.com/watch?v=CkQS...l4IGxsZA%3D%3D

[MannixTT]

Just use the official windows (active) agent, there is a service discovery by default.
Hopefully you didn't changed this template but rather a clone...

[tchoula]

And... what to do when Agent 2 discovers all services EXCEPT the one I want to monitor?

[jhboricua]

Check that the 'Windows service' discovery is enabled. Then on the template or host macros, adjust the value for {$SERVICE.NAME.MATCHES} to match the services you want to monitor. In my experience, there's far too many windows service exclusions to put them all under the {$SERVICE.NAME.NOT_MATCHES} macro. So you're better off going with inclusion rather than exclusion.

[tchoula]

One way to monitor a specific Windows service: On a host, YourSpecificHost, that is already linked to the template "Windows by Zabbix agent active" do the following:

1. All hosts -> YourSpecificHost -> Items, clone a "State of service" Item. Insert the new service name in the Name and Key field. Do the same for the Tags. (name & service).
2. All hosts -> YourSpecificHost -> Triggers, open a similar trigger and clone the Trigger. Update the name and event name, set the severity you want, and replace the service name in the Expression.

If you want a custom notification for that specific service.
3. Alerts -> Trigger actions -> Create action